Technical impact
The Blog2Social plugin for WordPress contains a blind Server‑Side Request Forgery vulnerability that can be triggered via the getFullContent() function. Authenticated users with Subscriber or higher privileges can make the application issue HTTP requests to arbitrary URLs, enabling them to probe and potentially manipulate internal network resources. The flaw permits the attacker to read or modify data on internal services, compromising data confidentiality and integrity.
Affected Systems
The vulnerability affects all releases of the Blog2Social: Social Media Auto Post & Scheduler plugin up to and including version 8.6.0. Users running those versions on any WordPress installation are potentially impacted.
Risk and Exploitability
The CVSS base score of 4.3 indicates moderate severity; the EPSS score of less than 1% suggests a very low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to log in with at least Subscriber level privileges and to craft a request targeting the vulnerable function. If internal services are reachable from the server, the vulnerability can be used to exfiltrate data or perform unauthorized actions, but the lack of public exploitation data and the low EPSS score mitigate immediate risk.
